Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2.
This report refers to pbkdf2 NPM package <https://github.com/browserify/pbkdf2> and this <https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6> advisory about handling an unknown digest algorithm with returning a static value instead of raising an error.
perl-PBKDF2-Tiny-0.005 is not affected: $ perl -Ilib -MPBKDF2::Tiny=derive -e 'print derive(q{foo})' | hexdump -C Digest function 'foo' not supported at -e line 1.